Cyber Liability Insurance

A cyber policy combines first party coverage, for the insured's own costs, with third party coverage, for claims by others.

First party coverage usually includes:

• Incident response. Breach counsel, forensic investigators to find and contain the intrusion, notification to affected people, credit monitoring, a call center and public relations help.
• Cyber extortion. The cost of responding to ransomware or a threat to release data, including negotiation and, where lawful and agreed with the carrier, the payment.
• Data restoration. Rebuilding or restoring data and software damaged by an attack.
• Business interruption. Income lost and extra expense incurred while systems are down from an attack, after a waiting period measured in hours. Many policies extend this to outages at a vendor the business depends on, and some to system failures with no attack.
• Funds transfer fraud and social engineering. Money lost when a criminal tricks staff into paying a fake invoice or changing a payee's bank details, usually with a lower sublimit.
• Hardware replacement. Equipment made unusable by an attack, sometimes called bricking.

Third party coverage usually includes:

• Network security and privacy liability. Defense and settlement of claims by tenants, guests, residents or customers whose data was exposed.
• Regulatory defense and penalties. Responding to state regulators and attorneys general after a breach, and fines and penalties where the law allows them to be insured.
• Payment card liabilities. Fines and assessments owed under the payment card industry standards after a card data breach.
• Media liability. Claims arising from content on the business's website and online listings.

Cyber policies are written on a claims made basis, usually with a retroactive date, so an incident that began before that date or was known before the policy started is excluded. Other common exclusions:

• Bodily injury and property damage. Usually excluded, though some policies give limited cover for property damage caused by an attack. A hacked boiler that damages a building may fall between the cyber and property policies.
• War and infrastructure failure. Attacks attributed to a state at war, and failures of power, telecommunications or internet infrastructure the business does not control.
• Betterment. Upgrading systems beyond their condition before the attack.
• Contractual liability. Except for payment card obligations and certain privacy obligations.
• Failure to maintain security. Some forms exclude or reduce cover when controls the insured said were in place, such as multifactor authentication or backups, were not.
• Theft of the business's own money. Beyond the funds transfer and social engineering sublimit, loss of funds usually belongs on a crime policy, explained in the commercial crime insurance guide.

The other policies in the program exclude cyber in turn. Current general liability forms exclude injury from the disclosure of personal information, which leaves the liability policy that covers physical injuries silent on a breach, and the property form limits electronic data to a small amount.

Cyber premium is based on revenue, the type of business, the number and kind of records held, and above all the security controls in place. Two businesses of the same size can be priced very differently, or one declined, because of the answers to the security questions. Retentions apply per claim, and business interruption carries a waiting period measured in hours.

The limit should cover the cost of a realistic breach: forensic investigation, notification and monitoring for every person whose records are held, the lost income while systems are rebuilt, and the defense of claims and regulatory actions. For a management firm holding records for thousands of tenants, notification alone can be a significant cost. Check the sublimits as well as the main limit, especially social engineering, dependent business interruption and payment card assessments, which are often set well below the headline figure.

Cyber limits are usually separate from the umbrella, which generally excludes data and privacy claims, so the cyber limit is the whole of the protection for this exposure.

Cyber underwriting is now built around a set of controls. Without most of them, many carriers will not quote:

• Multifactor authentication on email, remote access and administrator accounts.
• Endpoint detection and response software on computers and servers.
• Backups kept offline or unchangeable, and tested by restoring from them.
• Regular patching, and a plan for systems that can no longer be patched.
• Email filtering and staff training on phishing and payment fraud.
• Call-back procedures to verify any change to bank details before paying.
• Separation between building systems, such as access control and building management, and the business network.
• For card payments, compliance with the payment card standards, preferably with card data handled by the processor.
• An incident response plan that names who calls whom.

Underwriters will also ask about prior incidents, the number of records held, the vendors with access to the network, and who manages IT. For property businesses, building systems installed by vendors with remote access are often the least visible exposure, and the underwriter will want to know who can connect to them and how.

Smart locks and cloud-based access control are the newer version of the same question. In a rental community where residents open their doors from a phone, an outage or a compromise at the vendor can lock people out or let the wrong people in. That event touches the cyber, liability and property policies at once, so it is worth asking in advance which one would respond.

A cyber claim starts with a phone call, and the first hours matter. Most policies provide a hotline and require the insured to use the carrier's panel of breach counsel and forensic firms, or to get consent before using others; costs incurred outside the panel may not be paid. Report a suspected incident immediately, even before it is confirmed. Do not wipe or rebuild systems before forensic investigators have preserved evidence, and do not pay a ransom or negotiate without the carrier's involvement.

Breach counsel directs the response, which keeps the forensic work under legal privilege, and decides whether notification is required. State breach notification laws set the rules and deadlines (see the FTC's data breach response guide for business), and they vary. The forensic firm finds how the attacker got in and what was taken, and the restoration work follows. Business interruption is measured much as it is on a property claim, from records of income before and after the outage.

Social engineering claims move differently. The key facts are how the payment instruction arrived, whether the call-back procedure was followed and how quickly the bank was notified. A fast call to the bank sometimes recovers the money before the claim is needed.

Any property business that holds personal data, takes card payments or moves money electronically has a cyber exposure, and most now do.

Management firms holding tenant data and trust funds carry a heavy concentration: applications, bank details and payment records for every building they manage, plus the wire fraud risk that comes with paying vendors and remitting to owners. Hotels taking guest cards at the desk and online face payment card liabilities, reservation system outages and guest data exposure, and a ransomware attack on the property management system can stop check-in.

Wash clubs billing members monthly hold recurring payment data and depend on point of sale and membership software to open each day. Dealers keeping customer credit applications hold financial records that attract both criminals and regulators. Owners of apartments and senior living communities hold tenant and resident data directly or through their managers, and should confirm whose policy responds if a breach happens at the manager. Senior living operators also hold residents' health information, which brings the federal HIPAA breach notification rules into the response and adds to the notification and regulatory work after a breach.

• No cyber policy at all. The owner assumed the property or liability policy covered it.
• A small social engineering sublimit. Payment fraud can happen to any business that pays vendors, and it is often the smallest limit on the policy.
• Controls on the application that are not in place. A claim denied or reduced because multifactor authentication was not enabled everywhere the application said.
• Vendor outages outside the policy. No dependent business interruption for the payment processor or reservation platform. A business income form written with the property policy will not respond without physical damage.
• Building systems left out. Access control, cameras and building management on the same network as email, with vendor remote access nobody reviews.